CVE-2025-41658

CODESYS Toolkit Exposes Sensitive Files via Default Permissions

State: Published
Severity: 5.5 Medium
Published: Aug 4, 2025
Updated: Aug 4, 2025
Reserved: Apr 16, 2025

Description

CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	CERTVDE

Weaknesses

CWE-276 Incorrect Default Permissions

Affected Products

Product	Versions
Runtime ToolkitCODESYS	0.0.0.0 to before 3.5.21.20Affected
Control for BeagleBone SLCODESYS	0.0.0.0 to before 4.16.0.0Affected
Control for emPC-A/iMX6 SLCODESYS	0.0.0.0 to before 4.16.0.0Affected
Control for IOT2000 SLCODESYS	0.0.0.0 to before 4.16.0.0Affected
Control for Linux ARM SLCODESYS	0.0.0.0 to before 4.16.0.0Affected
Control for Linux SLCODESYS	0.0.0.0 to before 4.16.0.0Affected
Control for PFC100 SLCODESYS	0.0.0.0 to before 4.16.0.0Affected
Control for PFC200 SLCODESYS	0.0.0.0 to before 4.16.0.0Affected
Control for PLCnext SLCODESYS	0.0.0.0 to before 4.16.0.0Affected
Control for Raspberry Pi SLCODESYS	0.0.0.0 to before 4.16.0.0Affected
Control for WAGO Touch Panels 600 SLCODESYS	0.0.0.0 to before 4.16.0.0Affected
Virtual Control SLCODESYS	0.0.0.0 to before 4.16.0.0Affected

References

https://certvde.com/de/advisories/VDE-2025-049

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.